Jan v0.4.12 'readFileSync' - Path Traversal

Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface. id: CVE-2024-36857 info: name: Jan v0.4.12 'readFileSync' - Path Traversal author: Yusuf Amr severity: high description: | Jan v0.4.12 was discovered to contain an arbitrary file rea...

Jan v0.4.12 - Arbitrary File Upload

An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via uploading a crafted file. id: CVE-2024-36858 info: name: Jan v0.4.12 - Arbitrary File Upload author: pussycat0x severity: critical description: | An arbitrar...

Malicious code in iomodra-fuoa-jan (npm)

Source: amazon-inspector 79a8d64fcbac8cbf3329d528bcafc376ae9ff39ae604c0f84a824f93e74c8f3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in inufi-gobali-jan (npm)

Source: amazon-inspector 3c8e32fd1fc94a64d4d0a5936b7f8a2e50c7762798c15c1dbd951baee37647d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Jan AI - Detect

Detects the Jan AI local server, an open-source ChatGPT alternative that runs models locally and exposes a Cortex-powered, OpenAI-compatible API default port 1337. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the Jan AI local server, an open-source ChatGPT alternative that runs models...

CVE-2026-66005

CVE-2026-66005 affects Jan up to version 0.8.4. The local API server has a CORS misconfiguration that replaces user-configured trusted hosts with a wildcard, reflecting arbitrary origins with credentials. This enables network-adjacent attackers to bypass trusted host restrictions and reach the un...

bitefix (>=0.0.1, <=0.0.4), jan-scraper (0.1.0b1) +2 more potentially affected by CVE-2026-55443 via langchain (0.1.1)

langchain PYPI version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on langchain and may be impacted: - bitefix =0.0.1, =0.2.0, =0.4.0 - rag-doc-search 0.1.2 Source cves: CVE-2026-55443 Source advisory: OSV:PYSEC-2026-2192...

Agent Zero Cross-Site Script Vulnerability

Agent Zero is an artificial intelligence framework developed by Jan Tomášek. Versions of Agent Zero prior to 1.15 contained a cross-site scripting vulnerability. This vulnerability stemmed from the lack of security headers when SVG files were provided through the imageget endpoint, which could le...

WordPress Creator LMS plugin <= 1.1.12 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by NumeX in WordPress Plugin Creator LMS versions = 1.1.12...

EUVD-2025-205979

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in janhenckens Dashboard Beacon allows Stored XSS.This issue affects Dashboard Beacon: from n/a through 1.2.0...

EUVD-2025-198829

Malicious code in jan-browser npm...

Malicious code in jan-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6061d20158eb6f2952932cac8bd818201360f36f2a4fd989357c12400c58a49b The package jan-browser was found to contain malicious code. Source: ghsa-malware a3954e4e8e77c870bfc41cd61410400a2f7ba85ce1d56123f2e672f63543e6e1 An...

MAL-2025-190847 Malicious code in jan-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6061d20158eb6f2952932cac8bd818201360f36f2a4fd989357c12400c58a49b The package jan-browser was found to contain malicious code. Source: ghsa-malware a3954e4e8e77c870bfc41cd61410400a2f7ba85ce1d56123f2e672f63543e6e1 An...

Malware in jan-browser

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-156811 Malicious code in iomodra-fuoa-jan (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79a8d64fcbac8cbf3329d528bcafc376ae9ff39ae604c0f84a824f93e74c8f3b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress Booking Manager plugin <= 2.1.17 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jan Barszcz in WordPress Plugin Booking Manager versions = 2.1.17...

EUVD-2005-3278

Malware in sbrugna...

EUVD-2024-1976

Malicious code in bioql PyPI...

EUVD-2024-26148

Malicious code in bioql PyPI...

CVE-2025-49423: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Syed Tahir Ali Jan Bulk YouTube Post Creator bulk-youtube-post-creator allows Reflected XSS.This issue affects Bulk YouTube Post Creator: from n/a through = 1.0...